# Financial services compliance playbook

**Audience:** Security / compliance officers, procurement, and IT in banks, payments, capital markets, and fintech evaluating Flow Analyzer for delivery governance.  
**Scope:** Maps **shipped** Part L controls to common financial-services vendor questionnaires.  
**Not legal advice** — adapt with your counsel and DPA.

**Customer DPIA workforce appendix (link only):** [customer-dpia-workforce-appendix.md](../../operations/customer-dpia-workforce-appendix.md)

Shared Part L matrix: [README.md](./README.md) · Public hub: `/compliance`

---

## Industry emphasis (financial services)

Financial buyers typically ask how Flow Analyzer supports **model / change risk governance for delivery metrics**, **auditability of configuration and access**, and **data residency** when work-tracker data stays behind the bank perimeter. Emphasize:

- Immutable-enough security event trail with operator forwarding limits (not an in-product SIEM).
- Clear DSAR split: individual SaaS users vs workforce roster held by the customer-as-controller.
- On-prem / air-gapped-friendly topology beside Jira Data Center when SaaS egress is blocked.

**GTM non-goals:** this pack does not claim developer scoring, BI designer, or cross-company industry benchmarks.

---

## Audit trail & security events

Flow Analyzer writes structured `flow_analyzer.*` security audit events (SSO JIT, data export, account delete, workforce acknowledgment, and related SaaS admin actions) to operator-controlled JSONL. Operators may forward logs to their SIEM; the product documents forwarding limits (**FR-COMP-12**) and does not provide an in-app SIEM.

Evidence: [operator-runbook — security audit JSONL](../../operations/operator-runbook.md#saas-security-audit-jsonl-task-1211) · FR-COMP-02 / FR-COMP-12 / FR-COMP-16.

---

## DSAR paths

| Request type | Path |
|--------------|------|
| Individual Flow Analyzer user | Profile self-service export (**FR-COMP-05**) and delete (**FR-COMP-06**) |
| Organization-wide / controller DSAR | **privacy@scrumdesk.com** (L-D1) |
| Workforce roster vs user account | Deleting a SaaS user does **not** erase customer workforce roster rows; roster erasure follows the workforce playbook and DPIA appendix |

Evidence: FR-COMP-05/06/07 · [workforce erasure](../../operations/operator-runbook.md#workforce-data-erasure-playbook) · [DPIA appendix](../../operations/customer-dpia-workforce-appendix.md).

---

## Retention & erasure

Default controls include scheduled data-retention cron (**FR-COMP-10**), **90-day** workspace soft-delete grace then hard purge (**FR-COMP-13**), and evaluation-note anonymization on user delete (**FR-COMP-07**). Operators tune retention env knobs documented in the runbook.

Evidence: [data retention cron](../../operations/operator-runbook.md#data-retention-cron-task-2531-fr-comp-10).

---

## On-prem / deployment reference architecture

For regulated banks that keep Jira Data Center on private networks, prefer Topology 1-style **on-prem Flow Analyzer beside Jira** (offline license, telemetry off by default per §18.5). SaaS EU residency remains available when egress is approved.

Evidence: [deployment.md — on-prem single-host](../../operations/deployment.md#on-prem-single-host) · platform administrator manual · enterprise procurement pack via sales when [#128](https://gitlab.com/scrumdesk/flow-analyzer/-/work_items/128) ships (contact **sales@scrumdesk.com** / `/contact` until then).

---

## Subprocessors & transfers

Minimal GDPR-aligned subprocessors (hosting, CRM, scheduling, SMTP, optional LLM when AI assist is enabled). Enterprise DPAs include change notification.

Evidence: [subprocessors.md](../../operations/subprocessors.md) · public `/subprocessors` · FR-COMP-11 · [ROPA](../../operations/records-of-processing.md) (FR-COMP-15).

---

## HIPAA — not applicable

Flow Analyzer does **not** process PHI by design. There is no BAA, HIPAA-ready badge, or healthcare-regulated programme in v25 (**v25 Q1**). Do not cite HIPAA as a control in financial-services questionnaires.

---

## Procurement question → answer → evidence

| Procurement question | Flow Analyzer answer | Evidence |
|----------------------|----------------------|----------|
| Where is delivery / tracker data stored? | Customer-chosen: SaaS with residency options, or on-prem beside Jira DC | ROPA · subprocessors · [on-prem deployment](../../operations/deployment.md#on-prem-single-host) |
| Do you provide audit logging for admin and DSAR actions? | Yes — security audit JSONL; optional operator forward | FR-COMP-12 · [audit JSONL](../../operations/operator-runbook.md#saas-security-audit-jsonl-task-1211) |
| How do employees exercise access / erasure rights? | Profile export/delete for SaaS users; org-wide via privacy@; workforce roster per DPIA | FR-COMP-05/06 · [DPIA appendix](../../operations/customer-dpia-workforce-appendix.md) |
| What is your retention and soft-delete policy? | Cron-enforced retention; 90-day workspace grace; note anonymization | FR-COMP-10/13/07 · [retention cron](../../operations/operator-runbook.md#data-retention-cron-task-2531-fr-comp-10) |
| Are you HIPAA compliant / ready? | **Not applicable** — no PHI | v25 Q1 · FR-COMP-04 |
| Are you SOC 2 Type II certified? | SOC 2 **readiness** only — not certified until an auditor issues a report | FR-COMP-04 |
| Who are your subprocessors? | Published registry (AWS, HubSpot, Calendly, SMTP, optional LLM) | FR-COMP-11 · `/subprocessors` |